More political parties are backing a law change to ensure Kiwis’ contact tracing data cannot be used beyond the Covid-19 response, but the Government remains insistent the rules are already fit for purpose
A push to provide stronger privacy protections for contact tracing data now has the support of four political parties in Parliament, leaving Labour as the sole holdout for legislative change.
The issue of how contact tracing data is used, and could be misused, has been bubbling away for some time and came into the spotlight again last week in relation to the Covid-positive woman who was refusing to share her movements around Northland with health officials.
When asked by Newsroom last week whether the Government would offer the woman immunity from any criminal charges in exchange for being candid about her whereabouts, Hipkins said public health officials did not use information gathered in interviews for any purpose other than eliminating Covid-19.
“The public health teams are not collecting information that’s then passed on and used in other law enforcement procedures, because to do so would mean that people wouldn’t provide the information in the first place.”
However, the standard of rules governing the use of contact tracing data has been called into question in the past, yet the Government has taken no new action to address those concerns.
In September, an open letter signed by over 100 lawyers, experts and academics said the public health order establishing mandatory recordkeeping had “insufficient” safeguards to protect against the misuse of data collected through either the Covid Tracer app or paper-based records.
Some are concerned that police or other law enforcement agencies could compel the release of the information through a search warrant or production order, while others have said the private sector could also misuse data collected through paper-based records.
“I’m not deluded and believing that just because we have some legislative protections, that’s suddenly going to mean that everybody now complies with contact tracing … [but]I think that it will make a lot of people feel more comfortable.”
– Dr Andrew Chen
Digital contact tracing expert Dr Andrew Chen, who wrote the September letter and has been advocating for legislative change for some time, told Newsroom some government officials appeared to see privacy and public health as distinct issues, which was not the case.
“Trust is really important for compliance with public health interventions, and protecting and respecting privacy is one of the things that influences trust.”
Public confidence was particularly important for contact tracing, which served as “one of your last lines of defence in managing an outbreak”.
While there were likely sufficient legislative and practical protections in place to protect information gathered during interviews with human contact tracers (as opposed to the Covid Tracer app) Chen said there was still a fundamental issue of trust in official assurances around data use.
“I’m not deluded and believing that just because we have some legislative protections, that’s suddenly going to mean that everybody now complies with contact tracing.
“I think that it will make a lot of people feel more comfortable, and that people who otherwise may have put down fake details on a sign-in sheet might put down actual details in a ballot box, or that people who were a bit more worried because they went to one place that they maybe shouldn’t have, they might be still happy to disclose that.”
ACT and the Greens have previously supported calls for more specific and stringent data protections, and the parties have now been joined by National and Te Pāti Māori – leaving Labour as the sole holdout within Parliament.
“There is not a high degree of trust, not only in the Government’s response but in how it treats our lives…it should give us an absolute legislative and policy assurance.”
– Debbie Ngarewa-Packer, Te Pāti Māori
National Party digital economy and communications spokesman Melissa Lee has drafted amendments which would create explicit protections for contact tracing data in two new pieces of Covid legislation before Parliament.
Lee told Newsroom she was preparing a member’s bill to tackle the issue before the Government announced its plan for new laws, and believed the lack of explicit legal protections could deter some people from using the Covid Tracer app.
“That just puts people’s minds at unease, they’re not at ease using the system because of those concerns.”
The Government needed to set down in legislation how data would be protected, rather than “relying on police tweets or off-hand comments by ministers at media stand-ups”, she said.
In countries like Indonesia and Singapore, data had been used for police investigations despite similar political assurances about limited access.
Te Pāti Māori co-leader Debbie Ngarewa-Packer told Newsroom her party was also supportive of stronger data protections, as the Government’s rush to develop Covid measures had left gaps that needed to be addressed.
Its “dismal failure” to support Māori through the pandemic, coupled with concerns about police profiling, meant it was more important to make sure there were no avenues for overreach in the use of contact tracing data.
“There is not a high degree of trust, not only in the Government’s response but in how it treats our lives … it should give us an absolute legislative and policy assurance.”
In a written statement, Hipkins told Newsroom the Government had been “at pains to reassure people that the information they supply to assist with the critical task of contact tracing will not be used for any other purposes”.
The privacy by design approach of the Covid Tracer app, as well as the wording in alert level orders and the Health Act 1956, made it clear that records would be safeguarded and only used when appropriate, he argued.
Hipkins said there were several powers already available under New Zealand law which could prevent use of that information by businesses and government agencies, including the Privacy Act and the Bill of Rights Act.
However, the Government was continuing to learn from other jurisdictions about how to ensure its legal framework for the Covid-19 response remained fit for purpose.
“We are currently looking at how we can strengthen the current provision to make data protections clearer in legislation.”
